[for-in] Sanitize for-in optimizations and fix bailout points.

src/crankshaft/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/crankshaft/hydrogen.h"
 
 #include <sstream>
 
 #include "src/allocation-site-scopes.h"
 #include "src/ast/ast-numbering.h"
@@ skipping 5296 matching lines @@
   BuildForInBody(stmt, each_var, enumerable);
 }
 
 
 void HOptimizedGraphBuilder::BuildForInBody(ForInStatement* stmt,
                                             Variable* each_var,
                                             HValue* enumerable) {
   HInstruction* map;
   HInstruction* array;
   HInstruction* enum_length;
+  BuildCheckHeapObject(enumerable);
+  Add<HCheckInstanceType>(enumerable, HCheckInstanceType::IS_JS_RECEIVER);
+  Add<HSimulate>(stmt->ToObjectId());
   bool fast = stmt->for_in_type() == ForInStatement::FAST_FOR_IN;
   if (fast) {
     map = Add<HForInPrepareMap>(enumerable);
-    Add<HSimulate>(stmt->PrepareId());
+    Push(map);
+    Add<HSimulate>(stmt->EnumId());
+    Drop(1);
+    Handle<Map> meta_map = isolate()->factory()->meta_map();
+    Add<HCheckMaps>(map, meta_map);
 
     array = Add<HForInCacheArray>(enumerable, map,
                                   DescriptorArray::kEnumCacheBridgeCacheIndex);
     enum_length = Add<HMapEnumLength>(map);
 
     HInstruction* index_cache = Add<HForInCacheArray>(
         enumerable, map, DescriptorArray::kEnumCacheBridgeIndicesCacheIndex);
     HForInCacheArray::cast(array)
         ->set_index_cache(HForInCacheArray::cast(index_cache));
   } else {
-    Add<HSimulate>(stmt->PrepareId());
-    {
-      NoObservableSideEffectsScope no_effects(this);
-      BuildJSObjectCheck(enumerable, 0);
-    }
-    Add<HSimulate>(stmt->ToObjectId());
-
     map = graph()->GetConstant1();
     Runtime::FunctionId function_id = Runtime::kGetPropertyNamesFast;
     Add<HPushArguments>(enumerable);
     array = Add<HCallRuntime>(Runtime::FunctionForId(function_id), 1);
     Push(array);
     Add<HSimulate>(stmt->EnumId());
     Drop(1);
     Handle<Map> array_map = isolate()->factory()->fixed_array_map();
     HValue* check = Add<HCheckMaps>(array, array_map);
     enum_length = AddLoadFixedArrayLength(array, check);
@@ skipping 8239 matching lines @@
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8